Upgrade to 5.5.1 = gsub fails?

[Callahan]

Hi,

While I'm not seeing any errors when doing a config check, my gsub that did work to strip down usernames is not no longer firing. Can't figure out why. It worked fine in 5.0.0.

So I use the following to simply strip out everything before the \ of a username so MY_DESTOP_PC\Joe.Bloggs becomes "Joe Bloggs".
The code:

mutate {
    	gsub => [ "UserName", "^(.*)[\\]", "" ]
}

Any ideas as to why this results in the username field ending up still showing as MY_DESTOP_PC\Joe.Bloggs?

Thanks.

[magnusbaeck (Magnus Bäck)]

I can't reproduce.

$ cat test.config 
input { stdin { } }
output { stdout { codec => rubydebug } }
filter {
  mutate {
    gsub => ["message", "^(.*)[\\]", "" ]
  }
}
$ echo 'MY_DESTOP_PC\Joe.Bloggs' | ~/logstash/logstash-5.5.1/bin/logstash -f test.config
ERROR StatusLogger No log4j2 configuration file found. Using default configuration: logging only errors to the console.
Sending Logstash's logs to /home/magnus/logstash/logstash-5.5.1/logs which is now configured via log4j2.properties
[2017-07-26T09:55:11,891][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.queue", :path=>"/home/magnus/logstash/logstash-5.5.1/data/queue"}
[2017-07-26T09:55:11,895][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.dead_letter_queue", :path=>"/home/magnus/logstash/logstash-5.5.1/data/dead_letter_queue"}
[2017-07-26T09:55:11,915][INFO ][logstash.agent           ] No persistent UUID file found. Generating new UUID {:uuid=>"6a52ce38-5d7a-4616-bcc1-d6ca4e6a4ec8", :path=>"/home/magnus/logstash/logstash-5.5.1/data/uuid"}
[2017-07-26T09:55:12,141][INFO ][logstash.pipeline        ] Starting pipeline {"id"=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>1000}
[2017-07-26T09:55:12,155][INFO ][logstash.pipeline        ] Pipeline main started
[2017-07-26T09:55:12,199][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
{
    "@timestamp" => 2017-07-26T07:55:12.181Z,
      "@version" => "1",
          "host" => "bertie",
       "message" => "Joe.Bloggs"
}
[2017-07-26T09:55:15,167][WARN ][logstash.agent           ] stopping pipeline {:id=>"main"}